Cockatrice/tools/installer-holder-probe/close_holders.h
sentry[bot] 30d3afc7b4
Some checks are pending
CodeQL / Analyze (cpp) (push) Waiting to run
CodeQL / Analyze (actions) (push) Waiting to run
Build Desktop / Configure (push) Waiting to run
Build Desktop / Debian 13 (push) Blocked by required conditions
Build Desktop / Debian 12 (push) Blocked by required conditions
Build Desktop / Fedora 44 (push) Blocked by required conditions
Build Desktop / Fedora 43 (push) Blocked by required conditions
Build Desktop / Servatrice_Debian 12 (push) Blocked by required conditions
Build Desktop / Ubuntu 24.04 (push) Blocked by required conditions
Build Desktop / Ubuntu 26.04 (push) Blocked by required conditions
Build Desktop / Arch (push) Blocked by required conditions
Build Desktop / Ubuntu 26.04 cover (push) Blocked by required conditions
Build Desktop / macOS 13 Intel (push) Blocked by required conditions
Build Desktop / macOS 14 (push) Blocked by required conditions
Build Desktop / macOS 15 (push) Blocked by required conditions
Build Desktop / macOS 26 Debug (push) Blocked by required conditions
Build Desktop / Windows 10 (push) Blocked by required conditions
Build Desktop / Prune caches (push) Waiting to run
Build Docker / Servatrice (arm) (push) Waiting to run
Build Docker / Servatrice (x86) (push) Waiting to run
Build Docker / Publish multi-platform Servatrice image (push) Blocked by required conditions
[Updater] Close a running Cockatrice when the installer asks (#7672)
* [Updater] Refuse a close that arrives while one is already asking

MainWindow::closeEvent() had a re-entrancy guard that returned without touching
the event. A QCloseEvent is accepted unless something ignores it, so a second
close request - an installer replacing our files posts one every 30 s - accepted
the close while the first one was still blocked on its own confirmation. close()
then hid this window, hid the confirmation dialog with it, and left the process
running inside the nested loop that dialog had opened: no window, no way to
answer it, and every later close request accepted into the same dead end. That
is what an update looked like when it could not close a running client, and it
is why the installer could name the process, bring it forward and ask it to
close for minutes without anything happening.

Track how far the shutdown has got instead. While a confirmation is up, a close
from anywhere else is refused, which leaves the question in front of the user;
once the shutdown has been accepted, a duplicate close (Qt delivers the event
twice on some platforms) is accepted again so it cannot cancel the quit.

* [Installer] Leave an instance that is asking a question alone

An instance that answered a close by hiding rather than quitting - the state the
client used to get into - has no visible window left, and the confirmation it is
waiting on is hidden with the window that owns it. The close probe only ever
looked at visible windows, so it restored the main window, posted WM_CLOSE into
the same dead end, and reported "still running" without saying why.

Show every window the instance left hidden before choosing the one to close, and
skip the close when the window it would reach is disabled: a modal dialog of the
instance's own is up, and posting the close then only hides the question again.
Name what is left of the window in the report as well - gone, still open, hidden
again, and whether the thread answers at all - so the log tells a refused close
from one that was never delivered.

* [Installer] Offer to end a Cockatrice that will not close

A close is a request, and an instance that does not answer it - waiting on a
question nobody is looking at, or stuck where a close cannot reach - leaves the
user with no way forward: the files cannot be replaced while it runs, and
clicking Yes again only repeats the request.

After a second close that changed nothing, offer the only thing that can free
the files: end it. The prompt says what it costs - an unsaved deck, a running
game or a setting it has not written yet - the default button is the safe one,
and it is a separate answer rather than a relabelled "Yes", so it is not
reached by clicking through the close prompt. Only cockatrice.exe is ever
ended: Oracle writes the card database in place and Servatrice is a service, so
both are named and left to the user, exactly as they are for the close.

The probe gains an --end-holders mode for it, and the uninstaller's guard gets
the same offer.

* [Installer] Never name the process that is doing the asking

The old uninstaller is started with _?= so it runs in place, from the very
directory it is emptying, and an installer can be downloaded into the folder it
installs to. Both are then processes running from the directory, so the probe
named them - and the guard asked the user to close the program that was asking.
That question cannot be answered: a close and the end offer both skip anything
that is not cockatrice.exe, so the guard repeated itself until the update or the
uninstall was cancelled.

The probe and the processes that started it are now never named, by either
lookup. The walk up the parent chain stops at the first program the payload
installs, because in an in-app update the installer's own parent is the
Cockatrice instance being replaced - the one the guard exists to name.

The Windows check held its locked file in the script that starts the probe, so
that holder is excluded by design now and the check read it as "nothing found".
It holds the file from a process of its own instead, and asserts the exclusion
itself: a file that only the asking process holds comes back as nothing.

* [Installer] Restore only the windows a user could answer

Showing every hidden window an instance owns put Qt's own bookkeeping windows on
screen: the tray icon keeps one to receive the TaskbarCreated message, styled
WS_OVERLAPPED and titled QTrayIconMessageWindow. Restored, it is an empty white
rectangle in the taskbar with no title bar to close it - it has no window
procedure that would hide it again, and the process is busy in the very loop the
restore is meant to break, so it stayed until the process was force-ended.

Only framed, non-empty windows are restored and considered for the close now.
That also keeps the close off Qt's tray window, which answers WM_CLOSE by asking
the application to terminate - a quit that skips the confirmation the close is
supposed to reach.

* [Installer] Uninstall the previous version before installing over it

A regular install over an existing one asked "a previous version must be
uninstalled", then ran the old uninstaller interactively. That uninstaller
put its confirmation page behind the installer window, where it could not be
answered, and it only removed the installation after the installer had
already written the new one over it.

Run the previous version's uninstaller silently instead. The installer has
already asked the question the user answered, so a second, hidden confirmation
is pure risk: with /S there is no window to be behind, and ExecWait is then
waiting for something that cannot outlive it. QuietUninstallString is used
when the old installation has one, otherwise /S is appended.

ExecWait only waits while the uninstaller runs in place: one that did not get
a usable _?= copies itself to %TEMP% and returns at once, while the copy keeps
deleting - which is how an uninstall can finish after the install it was
supposed to precede. Log the exit code and wait for the old cockatrice.exe to
disappear before restoring user data or writing anything, and abort with a
message instead of installing into a directory that is still being emptied.

Cancelling the "must be uninstalled" prompt now quits the installer; it used
to skip the page and install over the old version anyway.

* [Installer] Do not show windows the application has hidden

The guard restored every hidden window an instance owned before asking it to
close, so that a confirmation hidden together with its window would come back.
Windows does as it is told and shows them; the application does not, because Qt
still believes they are hidden and never paints them. What the user gets is a
blank white rectangle, on screen and on the taskbar, that answers nothing - and
the question it was meant to bring back is not answerable in it either.

An instance with no window a user could answer is named and left to the user
instead, and the prompt says what to do about it: open it from the notification
area. Ending it stays the last resort, offered once a close has been asked for
twice.

The abort after a failed uninstall now says what it saw - the old version is
still there after its uninstaller ran - instead of promising a removal that is
not happening, which is the state a cancelled old uninstaller leaves behind.

---------

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
2026-10-27 11:19:49 +01:00

82 lines
4 KiB
C++

#ifndef CLOSE_HOLDERS_H
#define CLOSE_HOLDERS_H
#include "holder_line.h"
#include <string>
#include <vector>
/**
* @brief What asking the holders to close did, in the form the installer logs.
*
* @c report is one line naming every holder, including the ones this deliberately
* leaves alone, because the installer repeats it in its log and in the second prompt.
*/
struct CloseHoldersResult
{
unsigned int askedToClose = 0; ///< holders a WM_CLOSE was posted to
std::wstring report; ///< one line, narrowed to ASCII when written
};
/**
* @brief Brings every running Cockatrice holding an installer file forward and asks it
* to close.
*
* The set is the Restart Manager answer, so it is exactly the processes holding a file of
* the previous version: nothing here has to guess at an executable path, and an
* application that merely shares the image name is never touched. Only cockatrice.exe is
* asked to close. Oracle and Servatrice are left to the user - Oracle writes the card
* database in place - and so is every service.
*
* One thing happens per instance: its main window is brought to the foreground, because
* Cockatrice may answer the close with a confirmation of its own that would otherwise open
* behind the installer's prompt. Then WM_CLOSE is posted to the main window, the same
* request as clicking its close button - unless the instance is asking a question of its
* own, which disables that window: posting the close then only hides the question, so it is
* brought forward and left to the user. An instance with no window a user could answer -
* one hidden in the notification area, say - is named and left to the user as well; showing
* its windows from here does not help, because the application would still believe they are
* hidden and never paint them. Stopping the process is never attempted.
*
* Once the requests are out, this waits up to @c waitMilliseconds for the processes to
* exit, so the caller can measure the purge immediately afterwards instead of sleeping
* for a fixed time or re-asking a question this call already answered. A process that is
* still running is described further: whether its window is gone, still open, hidden
* again, and whether it answers at all, so the log can tell an instance that refused the
* close from one that never received it.
*
* @param holders the Restart Manager answer, one entry per application or service
* @param waitMilliseconds how long to wait for the asked instances to exit, 0 to not wait
*/
CloseHoldersResult closeCockatriceHolders(const std::vector<Holder> &holders, unsigned long waitMilliseconds);
/**
* @brief What ending the holders did, in the form the installer logs.
*
* @c report is one line naming every holder, including the ones this deliberately leaves
* alone, because the installer repeats it in its log.
*/
struct EndHoldersResult
{
unsigned int ended = 0; ///< holders TerminateProcess was accepted for
std::wstring report; ///< one line, narrowed to ASCII when written
};
/**
* @brief Ends every running Cockatrice the probe named.
*
* This is the last resort behind the installer's "end it now" answer, never a first move: a
* client that is still running may have an unsaved deck, an open game or a settings write in
* flight, so the caller only gets here after the user picked it from a prompt that says so.
* Only cockatrice.exe is ended - Oracle writes the card database in place and Servatrice is a
* service, so both are named and left to the user, exactly as they are for the close.
*
* Waits up to @c waitMilliseconds for what it ended to be gone, so the caller can measure the
* purge immediately afterwards instead of racing a process that is still exiting.
*
* @param holders what the probe named, one entry per application or service
* @param waitMilliseconds how long to wait for the ended instances to be gone, 0 to not wait
*/
EndHoldersResult endCockatriceHolders(const std::vector<Holder> &holders, unsigned long waitMilliseconds);
#endif